CVE-2014-3004

Castor < 1.3.2 - XXE

Title source: rule

Description

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Ron Gutierrez · textremotemultiple

https://www.exploit-db.com/exploits/39205

View Code ZIP pw:eip

References (8)

[Various Sources] https://quickview.cloudapps.cisco.com/quickview/bug/CSCvm56811

[Third Party Advisory] http://lists.opensuse.org/opensuse-updates/2014-06/msg00043.html

[Exploit] http://packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.html

[Exploit] http://seclists.org/fulldisclosure/2014/May/142

[Third Party Advisory] http://secunia.com/advisories/59427

[Broken Link] http://www.securityfocus.com/bid/67676

[Vendor Advisory] https://www.oracle.com/security-alerts/cpujan2020.html

[Vendor Advisory] https://www.oracle.com/security-alerts/cpuoct2021.html

Scores

EPSS 0.0363

EPSS Percentile 87.9%

Details

CWE

CWE-611

Status published

Products (8)

castor/castor 0Maven

castor_project/castor 1.3

castor_project/castor 1.3.1

castor_project/castor < 1.3.2

opensuse/opensuse 13.1

opensuse_project/opensuse 12.3

org.castor/castor 0Maven

org.codehaus.castor/castor 0 - 1.3.3Maven

Published Jun 11, 2014

Tracked Since Feb 18, 2026